CmdID

CmdID / Files

MdSched.exe

Windows Memory Diagnostics Tool file version info

Program on Windows 6 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MdSched.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Memory Diagnostics Tool

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MdSched.exe · signed by Microsoft Windows

97b11fad30d5b0a6930aa1c480d130291bf50272e1aa9113ea422ed7551a341e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\MdSched.exe · signed by Microsoft Windows

043cf5da5a37a30ecc4bf526a811e7c474843fd25e45c691b82c1458318686e8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\MdSched.exe · signed by Microsoft Windows

ac2549c243de7c7b334cca215af81eb4289a864df9410d8c74b29b141d26eadb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\MdSched.exe · signed by Microsoft Windows

bc516f17afc7658c4f20726272d9ce9f77c83dd5575307b15dbbdeca6f04d273

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\MdSched.exe · signed by Microsoft Windows

071a7027621affe293f6c99af0700cc26beebf0974dc864ab5c9a1a6751cca2f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\MdSched.exe · not signed

1795e55a21685950e13465873866a4cb79bf6c958f121c124dbcd8d75f155e04

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.